Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.0ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans.Open the advisoryOct 18, 2026
- High7.6ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts s…Open the advisoryOct 18, 2026
- High8.6ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via P…Open the advisoryOct 18, 2026
- High7.2Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered met…Open the advisoryOct 18, 2026
- High8.7Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the ga…Open the advisoryOct 18, 2026
- Low2.1A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.Open the advisoryOct 18, 2026
- Low2.1A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.Open the advisoryOct 18, 2026
- Critical9.2WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions throCheck if you run itEPSS 0.00%Oct 18, 2026
- Critical9.3Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.Check if you run itEPSS 0.00%Oct 18, 2026
- High8.4JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-add…Open the advisoryOct 18, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.Th…Open the advisoryOct 18, 2026
- Medium6.5Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a t…Open the advisoryOct 18, 2026
- Medium6.5Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issu…Open the advisoryOct 18, 2026
- Medium6.5Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…Open the advisoryOct 18, 2026
- High7.5Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on al…Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointment…Open the advisoryOct 18, 2026
- High8.1Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with…Open the advisoryOct 18, 2026
- Medium6.5Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.Th…Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affec…Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects…Open the advisoryOct 18, 2026
- High8.8Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: fro…Open the advisoryOct 18, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational FormCheck if you run itEPSS 0.00%Oct 18, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics:Check if you run itEPSS 0.00%Oct 18, 2026
- High7.7The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter befor…Open the advisoryOct 18, 2026